Phish-Resistant MFA Rollout Planner
Plan a phased rollout of phish-resistant MFA (FIDO2, passkeys, Windows Hello for Business) across your organisation. Get a timeline, communication tips, and phase-by-phase runbook.
About this tool
How Phish-Resistant MFA Rollout Planner works
Tell the planner about your organisation, your infrastructure and readiness, and how change usually lands. It builds a phased plan: preparation, a pilot with the IT and security team, all admin accounts, an early adopter group, general rollout in waves, then clean-up and hardening.
Each phase comes with its timing, what success looks like and the risks to watch, plus tips for communicating the change to your users.
Questions
Does it connect to my tenant?
Nothing. You answer questions from what you know about your tenant, or can check in the admin centres; the tool doesn't sign in to Microsoft 365 or read anything from it.
Where do my answers go?
Your answers stay in your browser and are worked out there. The site only counts, anonymously, that the tool was opened, finished or downloaded.
Which methods count as phishing-resistant?
Passkeys (including passkeys in Microsoft Authenticator), FIDO2 security keys, Windows Hello for Business and certificate-based authentication. Push notifications, codes and SMS don't.
How do I run the campaign itself?
Give your users the Auth Guide for the how-to, and use Auth-Onboard to invite them in batches, follow up and track who has a passkey.
Related tools
Use it with
- Auth-OnboardRun a passkey and MFA campaign for your users: find who's on SMS or codes, invite them in batches in your branding, follow up automatically and report progress. Installs into your own Azure. Try the live demo.
- Auth GuideStep-by-step help for your users: passkeys, number-matching MFA and security keys, sign-in on Windows, Mac, iPhone and Android, and what to do after a new or lost phone.
- Conditional Access Policy BuilderBuild a persona-based Conditional Access policy set around the Trust Levels, edit each policy visually, and export Graph JSON with a script that deploys it in report-only.
- Zero Trust ScorecardAssess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.